Authentication
API keys, environments, and how to send authenticated requests to the Dpaverify API.
API Keys
Every request requires a valid API key passed as a Bearer token. Generate one from your dashboard under Settings → API Keys.
Treat your API key like a password. Never commit it to source control or expose it in client-side JavaScript.
Two Environments
| Key prefix | Environment | Data | Charged? |
|---|---|---|---|
dpv_test_... | TEST | Sandbox sample data | No |
dpv_live_... | LIVE | Real government sources | Yes |
A test key always returns sandbox data and is never charged. Any verification run with a test key has "environment": "TEST" in the response. Use test keys freely during development.
Sending Requests
Pass your key in the Authorization header on every request:
POST /v1/verifications/identity.national-id HTTP/1.1
Host: api.dpaverify.com
Authorization: Bearer dpv_live_••••••••••••
Content-Type: application/json
{ "idNumber": "12345678" }Environment Variables
Store your key in an environment variable — never hard-code it:
# .env
DPAVERIFY_API_KEY=dpv_live_••••••••••••const response = await fetch('https://api.dpaverify.com/v1/verifications/identity.national-id', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.DPAVERIFY_API_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ idNumber: '12345678' }),
});Idempotency
For safe retries, add an Idempotency-Key header (up to 255 characters). A repeat request with the same key and body returns the original verification without charging again:
Idempotency-Key: order-1042-id-checkIf the same key is reused with a different request body, the API returns 409.
Revoking Keys
Revoke keys at any time from the dashboard. Revocation is immediate. Create a new key before revoking the old one to avoid downtime.